Horus Eye · Technical Debt

Clear the Salesforce debt that’s actually slowing you down

Technical debt in a Salesforce org isn’t messy code. It is every decision nobody went back to close: the Workflow Rules that outlived their engine, the three “final” versions of the same Flow, the object that quietly became load-bearing for five departments. Horus Eye measures that Salesforce technical debt with evidence, separates what matters from what merely exists — and clears the safe part of it itself.

Clear the Safe Ones in Your Org What Horus Eye is

Horus Eye next best actions: can clear now, needs your call, and sequence-together concentrations
Next best actions, ranked by leverage: what can be cleared now, the one decision that needs an owner, and the components worth fixing together.

The debt shows up long before anyone calls it that

Symptoms

It starts as friction nobody budgets for. Every release needs a broader regression pass than the last, because nobody can bound what a change touches. The backlog carries hundreds of components everyone suspects are dead — but the last “cleanup” broke quoting, so nothing gets deleted anymore, only added. The same discount rule lives in a Flow, an Apex trigger and a validation rule, written by three people in three eras, and they don’t quite agree. Automation runs on three engines at once — Workflow Rules and Process Builder still firing under the Flows that were meant to replace them. And the people who could explain any of it left in 2021.

The interest payment on this debt is testing surface: the gap between what a change actually touches and what you have to test because you can’t prove it doesn’t. That gap is measurable — which means it can be managed down.

How Horus Eye measures debt — real rules, published thresholds

Evidence, not vibes
Debt measured as severity-weighted exposure: findings stacked by severity against the components examined — a density of evidence, not a grade
The measure: severity-weighted findings against components examined — it moves when you clear.

Horus Eye’s Architecture, Automation and Development rules are specific enough to argue with — which is the point. A few of the ones this page is about:

God object

Flagged only when an object is both a relative outlier (top 5% of this org on fields, automation layers or inbound dependencies) and above an absolute floor — at least 150 fields, 5 automation layers, or 40 inbound dependencies — so a small org never flags its biggest-but-fine object. A structural observation, not a design verdict: some domains legitimately centralize.

Workflow Rules still carrying logic

One finding per object, not per rule — rules on one object share its save order and migrate together as one piece of work. And managed-package rules are excluded outright: on one org this was built against, 14 of 16 workflow rules belonged to installed packages. Reporting all 16 would hand you a migration backlog that is 87% not yours. The vendor’s rules are named as context, never as work.

Components below the API retirement line

Versions below 31.0 are past the line today — calls fail when the version is switched off; below 46.0 is the announced baseline, working on borrowed time. One aggregate finding per component type, because a version uplift is one workstream, not one alarm per class.

Orphaned components & duplicate automation

“Nothing references this” is a signal to check, not a verdict — scheduled jobs and invocable actions can hide references, and the rule says so. Two triggers on one object are flagged because Salesforce doesn’t guarantee execution order between them — whether the split is intentional is a question for the owner, and Horus asks it instead of assuming.

Every rule reports what it examined, what was clean, and what it could not read. That coverage honesty is what makes the numbers usable in front of a CFO.

Technical debt isn’t just old code

The wider ledger

The word “debt” makes people picture Apex from 2016. Most Salesforce technical debt never touched a code editor: duplicate fields feeding different reports, overlapping Flows with an execution order nobody chose, obsolete reports and unused layouts multiplying upkeep, record types that each demanded their own page, legacy profiles nobody dares consolidate, hardcoded IDs inside integration configuration, managed-package coupling, business logic that exists only in one departed admin’s memory. Configuration debt compounds exactly like code debt — it just hides better, because every piece of it still technically works.

Which is why Horus Eye doesn’t hand you a deletion list. Every finding lands in a lane:

Safe to automate

Sixteen sanctioned, reversible operations — retiring unused permission sets, cleaning inactive assignments, consolidating duplicates — each approved by you, validated with zero writes, verified by re-scan.

Guided remediation

A written plan for what needs hands: the steps, the order, the blast radius — executed by your team or exported to your pipeline.

Architect review & business decisions

Structural calls — domain seams, sharing-model redesign, which implementation owns a rule — go to people. Horus brings the evidence; the judgment stays human.

Accepted debt

Some debt is a rational trade. Name it, price it, and keep it deliberately — on the record, re-measured every scan, instead of rediscovered in every estimate.

Findings carrying the Modernization & AI Readiness lens, including API-version and retired-engine debt
One workstream, not forty alarms: the API-version finding aggregates by component type, retired-version components first.

The debt that hides in duplication

One rule, three engines
ILLUSTRATIVE HORUS EYE FINDING · DEMO ORGMEDIUM

One business rule implemented independently in Flow, Apex and a Validation Rule

What Horus Eye detected
A discount-approval condition appears to be enforced by a record-triggered Flow, an Apex trigger and a validation rule on Opportunity — three implementations, three owners, three eras.
Evidence
Shared fields written and overlapping entry conditions across the three components; the automation stack on the object shown in execution order.
Why it matters
Three implementations drift. When the rule changes, it changes in one place and silently not in the others — and the org’s behavior depends on execution order Salesforce does not guarantee across technologies.
Recommendation
Decide which implementation owns the rule, consolidate into it, and retire the others — Horus proposes the order and the re-scan proves the retirement changed nothing else.
Confidence
Moderate — behavioral overlap inferred from shared fields and conditions, labelled as inferred

This is the pattern metadata counts can’t see: each of the three components looks healthy alone. The debt lives between them.

The findings queue filtered to the Automation dimension

From findings to a plan: Now, Next, Later

Sequencing

A thousand findings is not a plan. Horus Eye ranks by leverage: the Now column is what can be cleared immediately; Next is what needs an owner’s call; Later is design work worth sequencing. Concentrations get called out explicitly — when one component carries several findings from several rules, fixing them together is one change window instead of four.

The Horus Eye Now / Next / Later remediation roadmap
The roadmap view: ordered by severity and your triage — the version of this page your steering committee sees.

“Let me clear it” — what that means for debt

The clearing

Some debt is safe for software to clear, and Horus Eye clears it: retiring unused permission sets, cleaning inactive-user assignments, consolidating record types, deactivating redundant validation rules, removing duplicate grants — each step approved by you, validated with zero writes first, reversible, and verified by the next scan.

The Horus Eye can-clear-now queue: findings whose fix is classified auto-safe
The “can clear now” queue — on the demo org, 35 findings whose fix path is classified auto-safe.
The fix controls after per-step approval: Validate first, then Fix it, with Roll back standing by

Flow and Apex consolidation stays guided — honestly. Horus proposes the consolidation order and names the components; a human makes the call; the re-scan proves the result. Prefer your own pipeline? Export the planned change as a Metadata API or SFDX bundle and promote it through CI/CD. And for the debt that is really an architecture program, Kemisoft’s Salesforce Health Assessment turns Horus Eye’s evidence into a remediation roadmap with owners and sequencing.

Frequently asked questions

Straight answers
What is technical debt in Salesforce?

Every configuration decision nobody went back to close: Workflow Rules that outlived their engine, duplicate versions of the same Flow, fields nothing references, objects that quietly became load-bearing for five departments. Not messy code — accumulated, unreviewed structure. And yes, you can measure technical debt in Salesforce: that is what the scan does, with published thresholds.

How do I measure Salesforce technical debt?

Not by counting metadata — by measuring exposure. Which objects are outlier hubs in this org, which automation runs on retired engines, what nothing references, what sits below the API retirement line — severity- weighted against the components examined. A density of evidence, not a grade of how the org is run.

How do I clean up an old Salesforce org?

In order: see the dependencies before touching anything; clear the auto-safe findings first (they build trust and shrink the noise); migrate retired-engine automation object by object, not rule by rule; then take the structural work — consolidation, decomposition — as sequenced projects with a re-scan after each.

How can I safely remove unused Salesforce metadata?

Treat “unused” as a signal, not a verdict. Verify indirect references a dependency graph can miss — scheduled Apex, invocable actions, direct page placements — confirm with the owner, retire in a sandbox, re-scan.

How do I know what metadata can be deleted?

You don’t, until something shows you what still depends on it. That is the dependency and blast-radius question — a fuller treatment is coming in this cluster’s change-impact page.

Why are Salesforce releases becoming slower?

Usually coupling, not size. When one object’s automation spans three technologies and seven fields have independent writers, every change carries an unbounded regression surface. Slower releases are the interest payment; the principal is the coupling.

Protected AI — the Trust Layer

Every AI read in Horus Eye is metadata-first: built from an allowlist, sanitized by pattern, made through one audited gateway and checked by an output firewall on the way back — and AI is off by default, per org. Every request carries an audit id and an AI Data Scope manifest you can open.

See the Trust Layer

Start where the debt is cheapest to clear

A first scan shows the auto-safe queue in minutes — the debt you could be rid of this week, before anyone debates the hard parts.

Try Horus Eye Clear the Safe Ones in Your Org All Horus Eye pages